# Characterizing Adversarial Examples Based on Spatial Consistency Information for Semantic Segmentation

arXiv: https://arxiv.org/abs/1810.05162 · HTML: https://mlsanity.com/paper/1810.05162/

## Key facts

- Cited by 40 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 11 Oct 2018.

## Built on by (most cited first, 30 of 40)

- [Unsolved Problems in ML Safety](https://mlsanity.com/paper/2109.13916/) (2021)
- [Invisible for both Camera and LiDAR: Security of Multi-Sensor Fusion based Perception in Autonomous Driving Under Physical-World Attacks](https://mlsanity.com/paper/2106.09249/) (2021)
- [SegPGD: An Effective and Efficient Adversarial Attack for Evaluating and Boosting Segmentation Robustness](https://mlsanity.com/paper/2207.12391/) (2022)
- [LOT: Layer-wise Orthogonal Training on Improving ℓ2 Certified Robustness](https://mlsanity.com/paper/2210.11620/) (2022)
- [End-to-end Prostate Cancer Detection in bpMRI via 3D CNNs: Effects of Attention Mechanisms, Clinical Priori and Decoupled False Positive Reduction](https://mlsanity.com/paper/2101.03244/) (2021)
- [Perceptual Attacks of No-Reference Image Quality Models with Human-in-the-Loop](https://mlsanity.com/paper/2210.00933/) (2022)
- [Adversarial Attacks on Black Box Video Classifiers: Leveraging the Power of Geometric Transformations](https://mlsanity.com/paper/2110.01823/) (2021)
- [Taxonomy of Machine Learning Safety: A Survey and Primer](https://mlsanity.com/paper/2106.04823/) (2021)
- [Towards Robust Neural Image Compression: Adversarial Attack and Model Finetuning](https://mlsanity.com/paper/2112.08691/) (2021)
- [Knowledge Enhanced Machine Learning Pipeline against Diverse Adversarial Attacks](https://mlsanity.com/paper/2106.06235/) (2021)
- [Evaluating Adversarial Attacks on Driving Safety in Vision-Based Autonomous Vehicles](https://mlsanity.com/paper/2108.02940/) (2021)
- [Recognizing Object by Components with Human Prior Knowledge Enhances Adversarial Robustness of Deep Neural Networks](https://mlsanity.com/paper/2212.01806/) (2022)
- [PointDP: Diffusion-driven Purification against Adversarial Attacks on 3D Point Cloud Recognition](https://mlsanity.com/paper/2208.09801/) (2022)
- [Adversarial Examples on Segmentation Models Can be Easy to Transfer](https://mlsanity.com/paper/2111.11368/) (2021)
- [Exploiting Multi-Object Relationships for Detecting Adversarial Attacks in Complex Scenes](https://mlsanity.com/paper/2108.08421/) (2021)
- [ADC: Adversarial attacks against object Detection that evade Context consistency checks](https://mlsanity.com/paper/2110.12321/) (2021)
- [Towards Reliable Evaluation and Fast Training of Robust Semantic Segmentation Models](https://mlsanity.com/paper/2306.12941/) (2023)
- [Reducing Texture Bias of Deep Neural Networks via Edge Enhancing Diffusion](https://mlsanity.com/paper/2402.09530/) (2024)
- [TPC: Transformation-Specific Smoothing for Point Cloud Models](https://mlsanity.com/paper/2201.12733/) (2022)
- [CARE: Certifiably Robust Learning with Reasoning via Variational Inference](https://mlsanity.com/paper/2209.05055/) (2022)
- [TranSegPGD: Improving Transferability of Adversarial Examples on Semantic Segmentation](https://mlsanity.com/paper/2312.02207/) (2023)
- [Uncertainty-weighted Loss Functions for Improved Adversarial Attacks on Semantic Segmentation](https://mlsanity.com/paper/2310.17436/) (2023)
- [Adversarially Robust Models may not Transfer Better: Sufficient Conditions for Domain Transferability from the View of Regularization](https://mlsanity.com/paper/2202.01832/) (2022)
- [Semantically Stealthy Adversarial Attacks against Segmentation Models](https://mlsanity.com/paper/2104.01732/) (2021)
- [We Can Always Catch You: Detecting Adversarial Patched Objects WITH or WITHOUT Signature](https://mlsanity.com/paper/2106.05261/) (2021)
- [Influencer Backdoor Attack on Semantic Segmentation](https://mlsanity.com/paper/2303.12054/) (2023)
- [A Certified Radius-Guided Attack Framework to Image Segmentation Models](https://mlsanity.com/paper/2304.02693/) (2023)
- [Uncertainty-based Detection of Adversarial Attacks in Semantic Segmentation](https://mlsanity.com/paper/2305.12825/) (2023)
- [A Review of Adversarial Attacks in Computer Vision](https://mlsanity.com/paper/2308.07673/) (2023)
- [Auditing AI models for Verified Deployment under Semantic Specifications](https://mlsanity.com/paper/2109.12456/) (2021)

## Abstract (arXiv)

Deep Neural Networks (DNNs) have been widely applied in various recognition tasks. However, recently DNNs have been shown to be vulnerable against adversarial examples, which can mislead DNNs to make arbitrary incorrect predictions. While adversarial examples are well studied in classification tasks, other learning problems may have different properties. For instance, semantic segmentation requires additional components such as dilated convolutions and multiscale processing. In this paper, we aim to characterize adversarial examples based on spatial context information in semantic segmentation. We observe that spatial consistency information can be potentially leveraged to detect adversarial examples robustly even when a strong adaptive attacker has access to the model and detection strategies. We also show that adversarial examples based on attacks considered within the paper barely transfer among models, even though transferability is common in classification. Our observations shed new light on developing adversarial attacks and defenses to better understand the vulnerabilities of DNNs.